Эксплуатируемые и новые серьёзные CVE: июль 2018 г.

A SQL Injection vulnerability exists in Zoho ManageEngine Applications Manager 13.x before build 13800 via the j_username parameter in a /j_

• Без аутентификации
• SQL-инъекция

zohocorp · manageengine applications manager2 июл. 2018 г.

An issue was discovered in PRTG Network Monitor before 18.2.39.

• RCE
• Инъекция команд

paessler · prtg network monitor2 июл. 2018 г.

The vulnerability is due to insufficient handling of update_file request parameter on update_module.php in Schneider Electric U.motion Build

schneider-electric · u.motion builder3 июл. 2018 г.

DNN (aka DotNetNuke) before 9.2.0 suffers from a Server-Side Request Forgery (SSRF) vulnerability in the DnnImageHandler class.

• Без аутентификации
• SSRF

dnnsoftware · dotnetnuke3 июл. 2018 г.

Versions of Apache CXF Fediz prior to 1.4.4 do not fully disable Document Type Declarations (DTDs) when either parsing the Identity Provider

• Без аутентификации
• Отказ в обслуживании

apache · cxf fediz5 июл. 2018 г.

An issue was discovered in ntopng 3.4 before 3.4.180617.

• Без аутентификации

ntop · ntopng5 июл. 2018 г.

uniquesig0/InternalSite/InitParams.aspx in Microsoft Forefront Unified Access Gateway 2010 allows remote attackers to trigger outbound DNS q

• Без аутентификации
• SSRF

microsoft · forefront unified access gateway5 июл. 2018 г.

The getTip() method of Action Columns of Sencha Ext JS 4 to 6 before 6.6.0 is vulnerable to XSS attacks, even when passed HTML-escaped data.

• Без аутентификации
• XSS

sencha · ext js5 июл. 2018 г.

All ADB broadband gateways / routers based on the Epicentro platform are affected by an authorization bypass vulnerability where attackers a

• Без аутентификации
• Нарушение контроля доступа (IDOR)

adbglobal · dv2210 firmware6 июл. 2018 г.

PrestaShop before 1.6.1.20 and 1.7.x before 1.7.3.4 mishandles cookie encryption in Cookie.php, Rinjdael.php, and Blowfish.php.

• Без аутентификации

prestashop · prestashop9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflo

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflo

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-fr

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-fr

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-fr

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflo

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflo

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-fr

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflo

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflo

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-fr

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Heap Overflo

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Out-of-boun

• Без аутентификации
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an Untrusted p

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-fr

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Use-after-fr

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have a Double Free

• RCE без входа
• Ошибки памяти

adobe · acrobat dc9 июл. 2018 г.

Adobe Acrobat and Reader versions 2018.011.20038 and earlier, 2017.011.30079 and earlier, and 2015.006.30417 and earlier have an NTLM SSO ha

• Без аутентификации
• Утечка информации

adobe · acrobat dc9 июл. 2018 г.

Adobe Flash Player versions 29.0.0.171 and earlier have an Integer Overflow vulnerability.

• Без аутентификации
• Ошибки памяти

adobe · flash player desktop runtime9 июл. 2018 г.

Adobe Flash Player versions 29.0.0.171 and earlier have an Out-of-bounds read vulnerability.

• Без аутентификации
• Ошибки памяти

adobe · flash player desktop runtime9 июл. 2018 г.

Adobe Flash Player versions 29.0.0.171 and earlier have a Stack-based buffer overflow vulnerability.

• RCE
• Ошибки памяти

adobe · flash player desktop runtime9 июл. 2018 г.

Legion of the Bouncy Castle Legion of the Bouncy Castle Java Cryptography APIs 1.58 up to but not including 1.60 contains a CWE-470: Use of

• Без аутентификации
• Десериализация

bouncycastle · bc-java9 июл. 2018 г.

A security feature bypass vulnerability exists when Microsoft Internet Explorer improperly handles requests involving UNC resources, aka "In

• Без аутентификации

microsoft · internet explorer10 июл. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A Security Feature Bypass vulnerability exists in ASP.NET when the number of incorrect login attempts is not validated, aka "ASP.NET Securit

• Без аутентификации
• Обход аутентификации

microsoft · asp.net core10 июл. 2018 г.

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an u

• RCE

microsoft · expression blend10 июл. 2018 г.

A denial of service vulnerability exists when Windows improperly handles File Transfer Protocol (FTP) connections, aka "Windows FTP Server D

• Без аутентификации
• Отказ в обслуживании

microsoft · windows 1010 июл. 2018 г.

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

• RCE без входа
• Ошибки памяти

microsoft · internet explorer10 июл. 2018 г.

A Remote Code Execution vulnerability exists in .NET software when the software fails to check the source markup of a file, aka ".NET Framew

• RCE без входа

microsoft · .net framework10 июл. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory, aka

• RCE

microsoft · office10 июл. 2018 г.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

• RCE без входа
• Ошибки памяти

microsoft · chakracore10 июл. 2018 г.

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote

• RCE без входа

microsoft · .net framework10 июл. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

• RCE без входа
• Ошибки памяти

microsoft · internet explorer10 июл. 2018 г.

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

• RCE без входа
• Ошибки памяти

microsoft · internet explorer10 июл. 2018 г.

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis

• Без аутентификации
• Утечка информации

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in the way the scripting engine handles objects in memory in Microsoft browsers, aka "Scripting

• RCE без входа

microsoft · internet explorer10 июл. 2018 г.

A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip

• RCE без входа
• Ошибки памяти

microsoft · internet explorer10 июл. 2018 г.

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis

• Без аутентификации
• Утечка информации

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in the way that the ChakraCore scripting engine handles objects in memory, aka "Scripting Engin

• RCE без входа

microsoft · chakracore10 июл. 2018 г.

A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application pa

• RCE

microsoft · sharepoint enterprise server10 июл. 2018 г.

A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio

• RCE без входа
• Ошибки памяти

microsoft · edge10 июл. 2018 г.

A denial of service vulnerability exists in Windows Domain Name System (DNS) DNSAPI.dll when it fails to properly handle DNS responses, aka

• Без аутентификации
• Отказ в обслуживании

microsoft · windows 1010 июл. 2018 г.

A remote code execution vulnerability exists when Skype for Business and Microsoft Lync clients fail to properly sanitize specially crafted

• RCE без входа

microsoft · lync10 июл. 2018 г.

A remote code execution vulnerability exists when Microsoft Access fails to properly handle objects in memory, aka "Microsoft Access Remote

• RCE

microsoft · access10 июл. 2018 г.

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis

• Без аутентификации
• Утечка информации

microsoft · edge10 июл. 2018 г.

A remote code execution vulnerability exists in PowerShell Editor Services, aka "PowerShell Editor Services Remote Code Execution Vulnerabil

• RCE без входа

microsoft · powershell10 июл. 2018 г.

Apache CouchDB administrative users can configure the database server via HTTP(S).

• RCE

apache · couchdb11 июл. 2018 г.

Crestron Airmedia AM-100 devices with firmware before 1.6.0 and AM-101 devices with firmware before 2.7.0 allows remote authenticated admini

• RCE

crestron · airmedia am-100 firmware11 июл. 2018 г.

VideoLAN VLC media player 2.2.x is prone to a use after free vulnerability which an attacker can leverage to execute arbitrary code via craf

• RCE без входа
• Ошибки памяти

videolan · vlc media player11 июл. 2018 г.

MFSBGN03811 rev.1 - Fortify Software Security Center (SSC), Multiple vulnerabilities

• Без аутентификации
• SSRF
• XXE

hp · fortify software security center12 июл. 2018 г.

Codiad through 2.8.4 allows Remote Code Execution, a different vulnerability than CVE-2017-11366 and CVE-2017-15689.

• RCE без входа

codiad · codiad12 июл. 2018 г.

An issue was discovered on WAGO e!DISPLAY 762-3000 through 762-3003 devices with firmware before FW 02.

• Загрузка файлов

wago · 762-3000 firmware12 июл. 2018 г.

MODX Revolution version <=2.6.4 contains a Incorrect Access Control vulnerability in Filtering user parameters before passing them into phpt

modx · modx revolution13 июл. 2018 г.

D-Link DIR routers contain a stack-based buffer overflow in the HNAP Login action

• Без аутентификации
• Ошибки памяти

dlink · dir-823 firmware13 июл. 2018 г.

The Sungard eTRAKiT3 software version 3.2.1.17 may be vulnerable to SQL injection which may allow a remote unauthenticated attacker to run a subset of SQL comma

• Без аутентификации
• SQL-инъекция

sungardas · etrakit313 июл. 2018 г.

ManageEngine Applications Manager 12 and 13, allows unserialization of unsafe Java objects

• Без аутентификации
• Обход аутентификации
• Десериализация

zohocorp · manageengine applications manager13 июл. 2018 г.

The uc-http service 1.0.0 on VelotiSmart WiFi B-380 camera devices allows Directory Traversal, as demonstrated by /../../etc/passwd on TCP p

• Без аутентификации
• Обход пути

velotismart project · velotismart wifi firmware15 июл. 2018 г.

An issue was discovered in Zoho ManageEngine Desktop Central before 100230.

• Без аутентификации
• Утечка информации

zohocorp · manageengine desktop central16 июл. 2018 г.

The websites that were built from Zeta Producer Desktop CMS before 14.2.1 are vulnerable to unauthenticated remote code execution due to a d

• RCE без входа
• Загрузка файлов

zeta-producer · zeta producer desktop cms16 июл. 2018 г.

The ConnectionBase::preparseNewBytes function in resip/stack/ConnectionBase.cxx in reSIProcate through 1.10.2 allows remote attackers to cau

• RCE без входа
• Ошибки памяти

resiprocate · resiprocate16 июл. 2018 г.

Exposure of Private Information in QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to access se

qnap · q\'center16 июл. 2018 г.

Command injection vulnerability in change password of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated

• RCE
• Инъекция команд

qnap · q\'center16 июл. 2018 г.

Command injection vulnerability in networking of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated user

• RCE
• Инъекция команд

qnap · q\'center16 июл. 2018 г.

Command injection vulnerability in date of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to r

• RCE
• Инъекция команд

qnap · q\'center16 июл. 2018 г.

Command injection vulnerability in SSH of QNAP Q'center Virtual Appliance version 1.7.1063 and earlier could allow authenticated users to ru

• RCE
• Инъекция команд

qnap · q\'center16 июл. 2018 г.